CVE-2022-0891

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact

• CWE-787

• https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7cPatch, Third Party Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0891.jsonThird Party Advisory, VDB Entry
• https://gitlab.com/libtiff/libtiff/-/issues/380Exploit, Issue Tracking, Patch, Third Party Advisory
• https://gitlab.com/libtiff/libtiff/-/issues/382Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/
• https://security.gentoo.org/glsa/202210-10Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221228-0008/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5108Third Party Advisory
• https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7cPatch, Third Party Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0891.jsonThird Party Advisory, VDB Entry
• https://gitlab.com/libtiff/libtiff/-/issues/380Exploit, Issue Tracking, Patch, Third Party Advisory
• https://gitlab.com/libtiff/libtiff/-/issues/382Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/
• https://security.gentoo.org/glsa/202210-10Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221228-0008/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5108Third Party Advisory

Published

Mar 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0885The Member Hero WordPress plugin through 1.0.9 lacks authori…9.8
• CVE-2022-0886Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-0887The Easy Social Icons WordPress plugin before 3.1.4 does not…7.2
• CVE-2022-0888The Ninja Forms - File Uploads Extension WordPress plugin is…9.8
• CVE-2022-0889The Ninja Forms - File Uploads Extension WordPress plugin is…6.1
• CVE-2022-0890NULL Pointer Dereference in GitHub repository mruby/mruby pr…5.5
• CVE-2022-0892The Export All URLs WordPress plugin before 4.2 does not san…6.1
• CVE-2022-0893Cross-site Scripting (XSS) - Stored in GitHub repository pim…5.4
• CVE-2022-0894Cross-site Scripting (XSS) - Stored in GitHub repository pim…5.4
• CVE-2022-0895Static Code Injection in GitHub repository microweber/microw…9.8
• CVE-2022-0896Improper Neutralization of Special Elements Used in a Templa…8.8
• CVE-2022-0897A flaw was found in the libvirt nwfilter driver. The virNWFi…4.3